integration_tests.yml

name: integration-tests

on:
  push:
    branches: ["main"]
    paths-ignore:
      - "**/*.md"
  pull_request:
    branches: ["main"]
    paths-ignore:
      - "**/*.md"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.id }}
  cancel-in-progress: true

permissions:
  contents: read

defaults:
  run:
    shell: bash

env:
  # Windows CI would fail without this.
  # Ref: https://gist.github.com/NodeJSmith/e7e37f2d3f162456869f015f842bcf15
  # TODO: can we fix windows encoding natively within reflex? Bug above can hit real users too (less common, but possible)
  # - Catch encoding errors when printing logs
  # - Best effort print lines that contain illegal chars (map to some default char, etc.)
  PYTHONIOENCODING: "utf8"
  REFLEX_TELEMETRY_ENABLED: false
  NODE_OPTIONS: "--max_old_space_size=8192"
  PR_TITLE: ${{ github.event.pull_request.title }}

jobs:
  example-counter-and-nba-proxy:
    env:
      OUTPUT_FILE: import_benchmark.json
    timeout-minutes: 30
    strategy:
      # Prioritize getting more information out of the workflow (even if something fails)
      fail-fast: false
      matrix:
        # Show OS combos first in GUI
        os: [ubuntu-latest, windows-latest]
        python-version: ["3.14"]

    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-tags: true
          fetch-depth: 0
      - uses: ./.github/actions/setup_build_env
        with:
          python-version: ${{ matrix.python-version }}
          run-uv-sync: true

      - name: Clone Reflex Examples Repo
        uses: actions/checkout@v4
        with:
          repository: reflex-dev/reflex-examples
          path: reflex-examples
      - name: Install requirements for counter example
        working-directory: ./reflex-examples/counter
        run: |
          uv pip install -r requirements.txt
      - name: Check export --backend-only before init for counter example
        working-directory: ./reflex-examples/counter
        run: |
          uv run reflex export --backend-only
      - name: Check run --backend-only before init for counter example
        run: |
          uv run bash scripts/integration.sh ./reflex-examples/counter dev 8001 --backend-only --backend-port 8001
      - name: Init Website for counter example
        working-directory: ./reflex-examples/counter
        run: |
          uv run reflex init --loglevel debug
      - name: Check export for counter example
        working-directory: ./reflex-examples/counter
        run: |
          uv run reflex export
      - name: Run Website and Check for errors
        run: |
          # Check that npm is home
          npm -v
          uv run bash scripts/integration.sh ./reflex-examples/counter dev
      - name: Install requirements for nba proxy example
        working-directory: ./reflex-examples/nba-proxy
        run: |
          uv pip install -r requirements.txt
      - name: Check export --backend-only before init for nba-proxy example
        working-directory: ./reflex-examples/nba-proxy
        run: |
          uv run reflex export --backend-only
      - name: Init Website for nba-proxy example
        working-directory: ./reflex-examples/nba-proxy
        run: |
          uv run reflex init --loglevel debug
      - name: Run Website and Check for errors
        run: |
          # Check that npm is home
          npm -v
          uv run bash scripts/integration.sh ./reflex-examples/nba-proxy dev

  reflex-docs:
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12"]

    env:
      REFLEX_WEB_WINDOWS_OVERRIDE: "1"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-tags: true
          fetch-depth: 0

      # Install sfw BEFORE any dependency installation so all packages are scanned.
      - name: Install Socket.dev Firewall (free)
        uses: SocketDev/action@2d3f25590c6ed6ba11a9a14c064d962a3a04698f # v1.3.1
        with:
          mode: firewall-free

      - name: Install Bun
        uses: oven-sh/setup-bun@v2
      - name: Activate sfw shims for npm and bun
        run: |
          SHIM_DIR="$(cd scripts/sfw-shims && pwd)"
          echo "$SHIM_DIR" >> "$GITHUB_PATH"
          echo "REFLEX_USE_SYSTEM_BUN=1" >> "$GITHUB_ENV"

      # Inline setup_build_env steps so all installs go through sfw.
      - name: Install UV
        uses: astral-sh/setup-uv@v6
        with:
          python-version: ${{ matrix.python-version }}
          enable-cache: true
          prune-cache: false
          activate-environment: true
          cache-dependency-glob: "uv.lock"
      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: 22

      # Build git+https deps as wheels outside sfw (avoids sfw MITM cert issues
      # with git), then install everything else through sfw for scanning.
      # TODO: revisit when https://github.com/SocketDev/sfw-free/issues/30 is resolved.
      - name: Pre-install git dependencies (outside sfw)
        run: |
          # Install git+https deps directly without sfw to avoid MITM cert issues.
          # Their transitive registry deps will still be scanned by sfw uv sync.
          grep -oP 'git\+https://[^"]+' uv.lock | sort -u > "$RUNNER_TEMP/git-deps.txt" || true
          if [ -s "$RUNNER_TEMP/git-deps.txt" ]; then
            echo "Installing git dependencies:"
            cat "$RUNNER_TEMP/git-deps.txt"
            uv pip install --no-deps -r "$RUNNER_TEMP/git-deps.txt"
          else
            echo "No git dependencies found."
          fi
      - name: Install Dependencies (scanned by Socket.dev)
        run: sfw uv sync

      # TODO: revisit when https://github.com/SocketDev/sfw-free/issues/30 is resolved.
      - name: Pre-install reflex-docs git dependencies (outside sfw)
        working-directory: ./docs/app
        run: |
          # Replace reflex-dev/reflex git deps with plain package names (PR version is pre-installed)
          sed -i -E 's|"([a-zA-Z0-9_-]+)\s*@\s*git\+https://github\.com/reflex-dev/reflex@[^"]*"|"\1"|g' pyproject.toml
          # Install git+https deps from pyproject.toml before pip compile resolves them.
          # Exclude reflex itself — the PR version is already installed.
          grep -oP 'git\+https://[^"'"'"']+' pyproject.toml | sort -u > git-requirements.txt || true
          if [ -s git-requirements.txt ]; then
            echo "Installing git dependencies:"
            cat git-requirements.txt
            uv pip install --no-deps -r git-requirements.txt
          fi
      - name: Compile and install reflex-docs requirements (scanned by Socket.dev)
        working-directory: ./docs/app
        run: |
          sfw uv pip compile pyproject.toml --no-annotate --no-header --no-deps --output-file requirements.txt
          uv pip list --format=json | jq -r '"^" + .[].name + "[ =]"' > installed_patterns.txt
          grep -ivf installed_patterns.txt requirements.txt > requirements.txt.tmp && mv requirements.txt.tmp requirements.txt
          rm installed_patterns.txt
          if [ -s requirements.txt ]; then
            sfw uv pip install -r requirements.txt
          fi
      - name: Verify installed reflex version matches this checkout
        run: |
          expected_sha="$(git rev-parse --short=8 HEAD)"
          installed_version="$(uv run --active --no-sync python -c 'import importlib.metadata as metadata; print(metadata.version("reflex"))')"
          echo "Expected checkout SHA: $expected_sha"
          echo "Installed reflex version: $installed_version"
          [[ "$installed_version" == *"+$expected_sha" ]]
      - name: Init Website for reflex-docs
        working-directory: ./docs/app
        run: uv run --active --no-sync reflex init
      - name: Run Website and Check for errors
        run: |
          # Verify sfw wrappers are on PATH
          which npm && npm -v
          uv run --active --no-sync bash scripts/integration.sh ./docs/app prod

      - name: Upload Socket.dev Firewall report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: sfw-report-reflex-docs-py${{ matrix.python-version }}
          path: ${{ env.SFW_JSON_REPORT_PATH }}
          if-no-files-found: warn

  rx-shout-from-template:
    strategy:
      fail-fast: false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-tags: true
          fetch-depth: 0
      - uses: ./.github/actions/setup_build_env
        with:
          python-version: 3.14
          run-uv-sync: true

      - name: Create app directory
        run: mkdir rx-shout-from-template
      - name: Init reflex-web from template
        run: uv run reflex init --template https://github.com/masenf/rx_shout
        working-directory: ./rx-shout-from-template
      - name: ignore reflex pin in requirements
        run: sed -i -e '/reflex==/d' requirements.txt
        working-directory: ./rx-shout-from-template
      - name: Install additional dependencies
        run: uv pip install -r requirements.txt
        working-directory: ./rx-shout-from-template
      - name: Run Website and Check for errors
        run: |
          # Check that npm is home
          npm -v
          uv run bash scripts/integration.sh ./rx-shout-from-template prod

  reflex-docs-macos:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    strategy:
      fail-fast: false
      matrix:
        # Note: py311 version chosen due to available arm64 darwin builds.
        python-version: ["3.11", "3.12"]
    runs-on: macos-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-tags: true
          fetch-depth: 0
      - uses: ./.github/actions/setup_build_env
        with:
          python-version: ${{ matrix.python-version }}
          run-uv-sync: true

      - name: Install reflex-docs dependencies
        working-directory: ./docs/app
        run: |
          uv pip compile pyproject.toml --no-annotate --no-header --no-deps --output-file requirements.txt
          uv pip list --format=json | jq -r '"^" + .[].name + "[ =]"' > installed_patterns.txt
          grep -ivf installed_patterns.txt requirements.txt > requirements.txt.tmp && mv requirements.txt.tmp requirements.txt
          rm installed_patterns.txt
      - name: Install Requirements for reflex-docs
        working-directory: ./docs/app
        run: uv pip install -r requirements.txt
      - name: Init Website for reflex-docs
        working-directory: ./docs/app
        run: uv run --active --no-sync reflex init
      - name: Run Website and Check for errors
        run: |
          # Check that npm is home
          npm -v
          uv run --active --no-sync bash scripts/integration.sh ./docs/app prod